Introduction

Turkey represents a substantial digital consumer market for international businesses.

A foreign company can reach Turkish customers through:

• its own international website;
• a Turkish-language website;
• a mobile application;
• an international marketplace;
• a Turkish online marketplace;
• social media;
• subscription services;
• digital products;
• SaaS platforms;
• direct-to-consumer shipping;
• or a locally incorporated Turkish subsidiary.

From a commercial perspective, entering the Turkish market can appear straightforward.

A company can translate its website into Turkish, activate international shipping, accept Turkish credit cards and start advertising to consumers in Istanbul, Ankara, Izmir, Antalya and other cities.

The legal structure is more complicated.

An overseas company selling products or services to consumers in Turkey can encounter several overlapping areas of Turkish law, including:

• Consumer Protection Law No. 6502;
• Distance Contracts Regulation;
• Law No. 6563 on Regulation of Electronic Commerce;
• regulations governing electronic commerce service providers and intermediary service providers;
• ETBIS — Electronic Commerce Information System;
• commercial electronic message rules and IYS — Message Management System;
• Personal Data Protection Law No. 6698 — KVKK;
• Turkish rules governing international transfers of personal data;
• advertising and unfair commercial practice rules;
• product liability and defective-goods provisions;
• taxation and customs;
• and Turkish private international law.

Foreign businesses should therefore avoid a common assumption:

“We are incorporated outside Turkey, so Turkish e-commerce law does not concern us.”

Corporate location is important, but it is not the only factor.

In cross-border consumer transactions, Turkish private international law can protect the mandatory rights arising under the law of the consumer’s habitual residence in circumstances specified by Article 26 of Law No. 5718. The statute permits a governing-law choice in consumer contracts but preserves the minimum protection available under the mandatory provisions of the consumer’s habitual-residence law when the statutory connection requirements are satisfied.

Accordingly, simply adding:

“This agreement is governed exclusively by the law of Country X”

to a website’s terms and conditions does not necessarily eliminate mandatory Turkish consumer protections in a transaction genuinely directed toward a Turkish consumer.

Foreign e-commerce companies should therefore structure their Turkish market entry around three separate questions:

How are we selling?

Which Turkish rules apply to that structure?

Where is the consumer’s data actually being processed?

Three Common Ways Foreign Companies Sell to Turkey

A useful legal analysis begins by identifying the commercial model.

Model 1 — Direct Cross-Border Sale

A company incorporated abroad sells through its own foreign website and ships directly to customers in Turkey.

For example:

A British clothing company operates from London.

A customer in Istanbul orders a coat from the British website.

The goods are shipped internationally directly to the customer.

The foreign company may have:

• no Turkish subsidiary;
• no Turkish office;
• no warehouse in Turkey;
• and no Turkish employees.

This is a genuine cross-border e-commerce model.

However, the absence of a Turkish subsidiary does not automatically resolve questions concerning consumer protection, applicable law, customs, data protection and jurisdiction. Article 26 of MÖHUK may preserve mandatory consumer protections connected with the consumer’s habitual residence where its statutory criteria are satisfied.

Model 2 — Sale Through a Turkish Marketplace

A foreign brand may sell through a Turkish electronic marketplace.

Here, the legal structure involves at least:

• the consumer;
• the seller;
• and the marketplace/intermediary.

Turkish electronic commerce legislation imposes separate obligations on electronic commerce service providers and electronic commerce intermediary service providers, while consumer law can impose specific platform responsibilities in distance contracts.

The seller should therefore not assume:

“The marketplace handles everything legally.”

Marketplace terms can allocate commercial responsibilities between platform and seller, but statutory obligations cannot simply be ignored.

Model 3 — Turkish Subsidiary or Local E-Commerce Company

A foreign group may establish:

ABC Turkey E-Commerce Ltd. Şti.

or

ABC Turkey A.Ş.

The Turkish company then:

• imports products;
• sells through its own website;
• invoices Turkish consumers;
• employs staff;
• processes customer data;
• contracts with couriers;
• and operates locally.

This structure creates the clearest Turkish regulatory footprint.

ETBIS, consumer law, KVKK, commercial electronic messaging and local corporate/tax requirements become central compliance areas.

The Core E-Commerce Law: Law No. 6563

Turkey’s principal electronic commerce statute is Law No. 6563 on Regulation of Electronic Commerce.

The Ministry of Trade currently lists Law No. 6563 together with the regulations governing electronic commerce service providers and intermediary service providers as part of the core electronic commerce legislation.

The law regulates areas including:

• information duties;
• electronic contracting;
• service providers;
• intermediary service providers;
• commercial electronic messages;
• and obligations applying to large e-commerce platforms.

Turkey substantially expanded its e-commerce regulatory structure through amendments adopted in 2022, especially in relation to electronic marketplaces and large operators.

The monetary thresholds used to determine certain platform obligations continue to be indexed, and the Ministry of Trade announced new 2026 threshold values in February–March 2026.

A foreign business operating a large marketplace or Turkish e-commerce group should therefore avoid relying on historical turnover thresholds.

Information That an E-Commerce Website Should Display

Turkish e-commerce rules emphasize transparency concerning the identity of the business.

The Ministry of Trade’s current ETBIS guidance states that an e-commerce service provider operating through its own environment should display identifying and communication information before beginning e-commerce activities.

For a merchant, this includes information such as:

• trade name;
• MERSIS number;
• registered office;
• electronic mail;
• phone details;
• KEP address where applicable;
• relevant professional organization information;
• and registered brand or business name where applicable.

This requirement reflects a broader principle:

The customer should be able to determine who the contractual seller actually is.

A website should not create ambiguity between:

• foreign parent company;
• Turkish subsidiary;
• logistics company;
• marketplace;
• distributor;
• and payment service provider.

This becomes especially important when a refund or defective-product dispute occurs.

The Website Should Explain How the Contract Is Formed

The Ministry of Trade also requires transparency concerning the technical steps through which an online contract is created.

Its current e-commerce guidance identifies matters including:

• how products or services are selected;
• delivery and payment information;
• how an order is confirmed;
• whether the electronic contract is stored;
• whether the customer can later access it;
• how input errors can be identified and corrected;
• relevant privacy rules;
• and available alternative dispute-resolution methods.

Therefore, an e-commerce checkout should not be designed solely as a sales funnel.

It is also a legal contracting mechanism.

A properly structured checkout should make it possible to prove:

what the customer ordered,

what price was accepted,

which terms applied,

and

when the contract was formed.

ETBIS: Does Every Online Seller Need Registration?

ETBIS stands for Elektronik Ticaret Bilgi Sistemi — Electronic Commerce Information System.

The system was established to register e-commerce businesses and collect e-commerce information.

The Ministry’s current FAQ states that ETBIS registration categories include:

• service providers operating in their own e-commerce environments;
• intermediary service providers; and
• Turkey-resident service providers that, while not carrying out domestic e-commerce activity, conclude contracts or receive orders through an intermediary service provider located abroad.

Therefore, whether ETBIS registration applies to a foreign business must be assessed according to the actual structure of the operation.

A foreign company should not use a simple rule such as:

“Foreign companies never register.”

or

“Any website accessible from Turkey must register.”

The analysis depends upon establishment, operating model and the business’s role in the transaction.

Selling Only Through Foreign Websites Can Still Create ETBIS Obligations for Turkey-Based Businesses

The Ministry’s current ETBIS guidance contains a particularly important rule for businesses established in Turkey but selling through foreign websites.

A service provider selling or accepting reservations solely through websites located abroad must register with ETBIS and report cross-border transactions annually by the end of March through the E-Export Transactions section. The Ministry states that these sellers do not otherwise have a monthly reporting obligation under that specific category.

This is especially relevant to Turkish subsidiaries of international groups using:

• Amazon abroad;
• foreign travel platforms;
• international booking systems;
• or a foreign group website.

ETBIS Registration Is Not a Government Guarantee of Reliability

Foreign businesses should also avoid using ETBIS registration as though it were an official government endorsement.

The Ministry expressly warns that ETBIS registration shows compliance with registration obligations but does not guarantee that an online business is safe or will never engage in unlawful conduct.

Compliance marketing should therefore avoid misleading claims such as:

“Approved and guaranteed by the Turkish government because we are ETBIS registered.”

Turkish Consumer Protection Law and Online Sales

The principal consumer statute is Law No. 6502 on Consumer Protection.

Online B2C transactions are particularly affected by the rules governing distance contracts — mesafeli sözleşmeler.

A distance contract is fundamentally a consumer contract concluded without the simultaneous physical presence of the parties through a system designed for remote marketing or contracting.

Typical examples include:

• website purchases;
• mobile-app purchases;
• telephone sales;
• certain social-media sales;
• and other remote sales systems.

The Distance Contracts Regulation establishes detailed requirements concerning:

• pre-contract information;
• confirmation;
• performance;
• delivery;
• withdrawal;
• refunds;
• and platform responsibilities. The Ministry’s consumer guidance continues to identify these rules as the central framework governing online consumer purchases.

Pre-Contract Information Is Essential

Before the consumer is bound by the contract, the seller or provider must provide prescribed information clearly.

This normally concerns matters such as:

• principal characteristics of goods or services;
• identity of the seller or provider;
• contact information;
• total price;
• additional charges;
• delivery;
• payment;
• withdrawal rights;
• complaint procedures;
• and other information required by the applicable transaction.

The Ministry specifically identifies Article 5 of the Distance Contracts Regulation as the provision governing pre-contract information obligations.

Foreign businesses should therefore localize more than just the product description.

A compliant Turkish checkout should include a legally appropriate pre-information form and distance sales contract where required.

Copying English-language U.S. or EU terms onto a Turkish website without adaptation can leave major compliance gaps.

The 14-Day Withdrawal Right

One of the best-known Turkish distance-sale protections is the consumer’s right of withdrawal.

The Ministry of Trade states that, as a general rule, a consumer entering into a distance contract has 14 days to withdraw without giving a reason and without contractual penalty.

For foreign sellers, this means that a policy stating:

“All online sales are final.”

can be unlawful where the transaction falls within the Turkish withdrawal-right regime and no statutory exception applies.

Businesses should structure:

• return procedures;
• customer service;
• warehouse operations;
• payment refunds;
• marketplace interfaces;
• and courier contracts

around the legal withdrawal process.

Not Every Online Purchase Has a Withdrawal Right

The 14-day rule is not absolute.

The Distance Contracts Regulation contains exceptions.

The Ministry’s current consumer guidance identifies examples including certain services performed immediately in electronic form and intangible digital products delivered immediately, such as downloaded digital content, where the regulatory conditions are satisfied.

Other statutory exceptions can apply depending on the nature of the goods or services.

Therefore, a business should not use the reverse assumption either:

“Every customer can return everything within 14 days.”

The correct analysis is product-specific.

Particular care is needed for:

• personalized products;
• rapidly perishable products;
• hygiene-related goods;
• digital content;
• event or accommodation services;
• and services begun during the withdrawal period.

The company’s website terms should identify only legally valid exceptions rather than invent new exclusions.

Delivery Deadlines

Distance sales also regulate performance.

For sales of goods, Turkish consumer legislation requires the seller to perform within the period promised and provides that the delivery period may not, in any event, exceed 30 days, subject to the specific statutory framework.

Where the seller fails to perform within the legally required period, the consumer may have termination and refund rights.

The Ministry’s distance-sales guidance explains that where the goods are not delivered within the required period, the consumer may terminate and recover payments with the legally applicable interest within the prescribed refund period.

A foreign company shipping from another continent should therefore not advertise delivery promises it cannot realistically satisfy.

Customs and international logistics need to be built into the legal delivery model.

“Out of Stock” Is Not a Complete Legal Strategy

Online businesses sometimes accept payment and later cancel the order because:

• inventory was wrong;
• the price was entered incorrectly;
• supplier costs increased;
• or demand exceeded expectations.

Turkish consumer law and distance-sales rules limit arbitrary cancellation practices.

The Ministry has specifically highlighted consumer protections against unjustified seller cancellation of distance-sale orders.

Inventory systems, dynamic pricing tools and order confirmation processes should therefore be designed to reduce sales that the company cannot honour.

Defective Goods: Withdrawal Is Not the Only Consumer Remedy

Foreign e-commerce companies frequently confuse:

withdrawal

with

defective goods.

They are separate concepts.

The withdrawal right allows the consumer to exit qualifying distance contracts within the statutory period even without alleging a defect.

Defective-goods rules apply where the product fails to satisfy contractual or legal expectations.

Turkish consumer law provides consumers with statutory remedies in defective-goods cases, including remedies such as refund, replacement and repair depending upon the applicable conditions. The Ministry’s current consumer materials continue to describe replacement and refund among the consumer’s statutory elective remedies.

Therefore:

“The 14-day return period expired”

does not automatically defeat a later claim that the product itself was defective.

Marketplace Sales: Who Is Responsible?

Online marketplaces create a multi-party relationship.

There may be:

• a seller;
• consumer;
• marketplace operator;
• courier;
• payment institution;
• and manufacturer.

Turkish e-commerce and distance-sales legislation contains specific rules concerning intermediary service providers and platform responsibilities.

The major 2022 reforms significantly strengthened the regulatory framework for electronic commerce intermediary service providers and large e-commerce businesses, and the Ministry continues to update the monetary thresholds applicable to these obligations annually.

A foreign merchant selling on a Turkish marketplace should therefore carefully review:

• marketplace merchant agreement;
• refund allocation;
• consumer communication;
• logistics obligations;
• commission;
• advertising rules;
• data access;
• complaint procedures;
• and liability allocation.

The platform agreement should not be assumed to override statutory consumer rights.

Commercial Electronic Messages and Marketing

E-commerce does not end when the customer leaves the checkout.

Marketing activity through:

• SMS;
• email;
• telephone;
• automated calls;
• and similar channels

is regulated under Turkish electronic commerce rules.

Commercial electronic message consent and withdrawal are connected with IYS — Ticari Elektronik İleti Yönetim Sistemi / Message Management System.

The Ministry’s current regulatory framework requires consent and refusal information to be handled within the legally prescribed IYS structure, including rules for authorized integrators.

Where a recipient submits a refusal, the Ministry states that the service provider must stop sending commercial electronic messages within three business days.

Foreign marketing teams should therefore not rely solely on their global CRM unsubscribe system where Turkish IYS rules apply.

Marketing Consent Should Not Be Forced Into the Purchase

Data protection adds another layer.

The Turkish Personal Data Protection Board issued an important principle decision in June 2025 concerning SMS verification during product and service provision.

The Board emphasized that where consent is relied upon for processing personal data for commercial electronic messages, marketing consent should not be made a compulsory condition for completing the provision of the product or service.

In practical terms, this means that a checkout should not say:

“You cannot buy unless you agree to receive advertising.”

where marketing consent is legally supposed to be optional.

Consent architecture should distinguish:

contract performance

from

marketing.

KVKK Applies to E-Commerce Data Processing

An e-commerce transaction creates significant personal-data processing.

Businesses may collect:

• name;
• surname;
• delivery address;
• billing information;
• telephone number;
• email;
• IP address;
• device identifiers;
• purchase history;
• payment-related information;
• browsing behaviour;
• location information;
• customer service recordings;
• and marketing preferences.

Personal Data Protection Law No. 6698 requires a lawful basis for processing personal data.

The KVKK framework does not require consent for every processing activity.

Article 5 permits processing without consent under specified legal bases, including where processing is directly necessary for the establishment or performance of a contract, compliance with legal obligations or other statutory grounds. The Board repeatedly applies this structure in its decisions.

For example, a seller generally does not need marketing consent simply to process the customer’s address where that address is necessary to deliver the purchased product.

This is different from using the address, telephone number or email later for unrelated advertising.

Privacy Notice and Consent Are Not the Same Thing

Foreign companies sometimes place one checkbox under a long privacy policy:

“I accept the privacy policy, terms, cookies and advertising.”

This can create problems.

Under Turkish data protection practice:

• the information/notice obligation — aydınlatma yükümlülüğü informs the person about processing;
• explicit consent — açık rıza is a separate legal basis used only where required;
• commercial electronic message consent has its own regulatory framework.

These concepts should not be merged indiscriminately.

The e-commerce site should therefore create separate legal architecture for:

• privacy notice;
• terms of sale;
• distance contract;
• marketing choice;
• and cookie consent where required.

Cookies and Online Advertising

Cookies are particularly important for international e-commerce companies using:

• Google Analytics;
• Meta Pixel;
• retargeting;
• affiliate networks;
• personalization;
• heat maps;
• advertising IDs;
• and other tracking technologies.

The Turkish Personal Data Protection Board has taken the position that where non-essential cookies do not have another valid processing basis, they should not be activated by default and an active opt-in mechanism should be used to obtain legally valid consent.

In its e-commerce cookie decision, the Board specifically distinguished strictly necessary cookies from functional, performance/analytics and advertising/marketing cookies and emphasized that non-essential cookies should not automatically operate where explicit consent is required.

Therefore:

“By continuing to browse, you accept all cookies”

can be legally inadequate.

Foreign Analytics and Cloud Services Can Create an International Data Transfer

This is one of the most important issues for foreign companies.

A Turkish e-commerce website may collect customer data in Turkey but use:

• a CRM hosted in Europe;
• AWS or another cloud provider abroad;
• a U.S.-based analytics provider;
• a global customer-service platform;
• overseas parent-company databases;
• foreign fraud-prevention tools;
• or a foreign email marketing provider.

Under Turkish rules, personal data can be regarded as transferred abroad where a controller or processor subject to the KVKK sends the information or otherwise makes it accessible to a controller or processor outside Turkey.

The KVKK Authority’s current guidance expressly describes making personal data accessible to a foreign controller or processor as an international transfer.

Therefore, international transfer analysis should consider not only where the business is incorporated but also:

where the servers are,

who can access the data,

and

where group-company personnel are located.

Turkey Changed Its International Data Transfer System in 2024

Foreign businesses using older Turkish privacy templates need particular caution.

Turkey fundamentally amended Article 9 of the KVKK in 2024.

The new international-transfer regime entered into force on 1 June 2024.

The new system follows a tiered structure.

International transfers may be based on:

1. an adequacy decision;
2. where adequacy is unavailable, one of the legally recognized appropriate safeguards;
3. where neither exists, one of the limited exceptional transfer situations, provided the statutory conditions—including the requirement that exceptional transfers be incidental rather than routine—are satisfied.

This is highly relevant for multinational e-commerce groups.

A company should not assume that a customer clicking:

“I agree to international transfers”

is the preferred legal solution for continuous global CRM operations.

Standard Contracts for Cross-Border Data Transfers

One of the most practically important changes is the introduction of standard contracts.

The Personal Data Protection Board approved four types of standard contracts on 4 June 2024:

• controller to controller;
• controller to processor;
• processor to processor;
• processor to controller.

A company must select the model corresponding to the actual roles of the parties.

For example:

A Turkish e-commerce subsidiary sending customer data to a foreign parent that determines its own processing purposes may involve a different standard contract from a transfer to a foreign cloud company processing data only on instructions.

Role classification therefore matters.

Standard Contracts Must Be Reported Within Five Business Days

Signing the standard contract is not the end of the process.

KVKK Article 9 requires the standard contract to be notified to the Authority within five business days after completion of signatures.

The Authority reiterated this rule in its February 2025 public guidance and explained that notification may be made through the legally accepted channels, including its Standard Contract Notification Module.

A multinational group should therefore create a compliance calendar.

Failing to notify a contract on time can create separate administrative exposure even where the transfer itself has been properly documented.

Binding Corporate Rules for Multinational Groups

Large international groups may also consider Binding Corporate Rules — Bağlayıcı Şirket Kuralları.

The current Article 9 framework recognizes Board-approved Binding Corporate Rules as an appropriate safeguard for transfers among companies belonging to the same enterprise group.

This can be valuable where a multinational e-commerce group regularly transfers:

• customer data;
• employee data;
• fraud information;
• CRM data;
• and analytics data

between Turkish and foreign group entities.

BCRs are generally more complex than using one standard contract, but they may provide a more scalable structure for large multinational operations.

A Foreign Company May Need a Turkish Data Controller Representative

Where a foreign data controller falls within the territorial scope of Turkish data protection obligations and is required to register with the Data Controllers Registry, rules concerning non-resident data controllers become important.

The VERBIS Regulation specifically provides for appointment of a data controller representative by data controllers not established in Turkey and describes the authority that representative must possess for dealings with the Turkish Data Protection Authority and data subjects.

Therefore, a foreign e-commerce business should not automatically assume that:

“We have no Turkish company, so VERBIS cannot apply.”

The company’s activities, Turkish data subjects and actual data-processing model must be analysed individually.

Consumer Complaints and Litigation

Foreign e-commerce businesses should plan dispute resolution before launching.

For 2026, Turkish Consumer Arbitration Committees have jurisdiction over qualifying consumer disputes with a value below TRY 186,000.

For disputes outside the arbitration committee’s monetary jurisdiction, Consumer Protection Law Article 73/A generally requires mandatory mediation before qualifying consumer-court litigation, subject to statutory exceptions. The Ministry’s 2026 guidance identifies the sequence of mandatory mediation followed by Consumer Court proceedings for relevant disputes outside the committee route.

This matters operationally.

A foreign seller should have a Turkish complaint-handling process capable of dealing with:

• Consumer Arbitration Committee notifications;
• mediation;
• Consumer Court proceedings;
• refund requests;
• and evidence production.

A Foreign-Law Clause Does Not Automatically Prevent Turkish Consumer Protection

This issue deserves separate emphasis.

Many international websites contain clauses such as:

“All disputes shall be governed exclusively by Delaware law.”

or:

“The consumer agrees that English law applies.”

Turkish MÖHUK Article 26 permits a choice of law in consumer contracts but preserves the minimum mandatory protection of the consumer’s habitual residence law within its statutory application conditions.

Accordingly, a foreign-law clause should not be used as the entire Turkish consumer-law compliance strategy.

The more deliberately the company directs its activities toward Turkey—for example through Turkish advertising, Turkish-language pages, local pricing, Turkish delivery and local customer acquisition—the more important a proper cross-border consumer-law analysis becomes.

Turkish-Language Terms Are Commercially and Legally Important

Foreign businesses frequently use English-only contractual terms.

This can create practical problems where the entire sales experience otherwise targets Turkish consumers.

Consumer terms and mandatory disclosures must be understandable.

At a minimum, a Turkish-market site should carefully consider Turkish versions of:

• pre-information form;
• distance sales agreement;
• withdrawal instructions;
• privacy notice;
• cookie notice;
• return policy;
• delivery information;
• and customer complaint process.

Machine translation should be legally reviewed.

A single mistranslated sentence concerning:

• liability;
• return costs;
• subscription renewal;
• or withdrawal rights

can create thousands of repeated consumer disputes when used across all orders.

Social Media Sales Are Still E-Commerce

Some businesses assume legal requirements disappear if the sale occurs through:

• Instagram;
• TikTok;
• WhatsApp;
• or another social media platform.

The legal classification depends on the transaction rather than whether a traditional web shop exists.

If a business systematically advertises a product remotely, receives an order and concludes a consumer sale through distance communication, distance-contract and consumer-law issues can still arise.

Social-commerce sellers should therefore maintain:

• seller identity information;
• price transparency;
• written order records;
• withdrawal procedures;
• invoice records;
• and data-protection compliance.

Influencer Marketing and Advertising

Foreign brands entering Turkey often rely heavily on influencers.

Marketing claims should comply with Turkish advertising and unfair commercial practice rules.

The company should verify that marketing does not:

• hide commercial sponsorship;
• make misleading performance claims;
• create false scarcity;
• advertise discounts deceptively;
• use fabricated consumer reviews;
• or otherwise mislead consumers.

The foreign brand can face reputational and regulatory exposure even where the influencer personally published the content.

Influencer agreements should therefore contain Turkish advertising-compliance obligations.

Subscription Businesses

Foreign SaaS, streaming, fitness, education and digital-service companies should pay particular attention to subscription law.

Turkey’s consumer framework regulates subscription agreements separately, including termination requirements.

The Ministry’s updated June 2026 guidance confirms, among other matters, specific deadlines concerning execution of consumer termination requests and repayment of prepaid amounts for unused periods.

Subscription design should clearly disclose:

• recurring price;
• renewal;
• duration;
• cancellation method;
• refund treatment;
• and termination rights.

Making sign-up easy but cancellation artificially difficult creates regulatory risk.

Tax and Customs Should Be Analysed Separately

Consumer and data compliance do not answer tax questions.

A foreign business sending physical products to Turkey should separately analyse:

• customs;
• import VAT;
• customs duties;
• product classification;
• importer-of-record structure;
• local taxation;
• permanent establishment risk;
• invoice rules;
• and any applicable simplified e-commerce customs regime.

A company can be fully compliant with distance-sales law but still have a customs problem.

Likewise, a valid Turkish consumer contract does not determine whether the foreign business has created a Turkish tax presence.

The tax, customs and consumer analyses should therefore be conducted in parallel.

Payment Processing

Foreign e-commerce businesses should also review how Turkish consumers will pay.

The business may use:

• international card acquiring;
• Turkish banks;
• payment institutions;
• electronic money companies;
• marketplace payment systems;
• or group-company infrastructure.

Payment flow influences:

• refund procedures;
• chargebacks;
• data processing;
• currency;
• accounting;
• and fraud risk.

The consumer should not be forced to navigate between seller, marketplace and payment provider without knowing who is responsible for the refund.

The commercial contracts among these participants should match the consumer-facing legal documents.

Common Compliance Mistakes by Foreign E-Commerce Companies

Copying Global Terms Without Turkish Adaptation

Global terms may conflict with Turkish withdrawal or consumer rights.

Saying “No Refunds”

A blanket no-refund rule may be incompatible with statutory distance-sale and defective-goods rights.

Failing to Provide Pre-Contract Information

Distance-sale obligations begin before the checkout is completed.

Ignoring the 30-Day Delivery Rule

Physical international shipping must be structured around Turkish performance rules.

Treating ETBIS as Optional Without Checking the Business Model

ETBIS obligations depend upon the actual structure of the service provider and intermediary relationship.

Forcing Marketing Consent During Checkout

Marketing consent should not be made a mandatory condition for completing the purchase where consent is the relevant processing basis.

Activating Advertising Cookies by Default

The KVKK Board has required active opt-in where non-essential cookies rely on explicit consent.

Sending Customer Data Abroad Without Analysing Article 9

Turkey’s international data-transfer framework changed fundamentally in 2024.

Signing a Standard Contract but Forgetting Notification

Standard contracts must be notified within five business days after signatures are completed.

Assuming a Foreign-Law Clause Eliminates Turkish Consumer Rights

MÖHUK Article 26 can preserve mandatory habitual-residence consumer protection.

Practical Compliance Checklist Before Launching E-Commerce in Turkey

A foreign company should answer the following questions before launching:

1. Which legal entity is the seller?
2. Is the seller foreign or Turkish?
3. Is a Turkish subsidiary required commercially or regulatorily?
4. Is the business selling through its own site or marketplace?
5. Does ETBIS registration apply?
6. Is seller identity clearly displayed?
7. Is there a compliant transaction guide?
8. Is there a Turkish pre-information form?
9. Is there a Turkish distance sales contract?
10. Is the 14-day withdrawal process implemented?
11. Which products fall within withdrawal exceptions?
12. Can goods realistically be delivered within applicable statutory deadlines?
13. How are refunds processed?
14. How are defective-goods claims handled?
15. Who bears marketplace responsibilities?
16. Are consumer complaints recorded?
17. Does IYS apply to marketing?
18. Can users refuse marketing easily?
19. Are marketing permissions separated from the purchase?
20. Is there a KVKK privacy notice?
21. What lawful bases are used for customer data?
22. Which cookies operate?
23. Are non-essential cookies opt-in where required?
24. Where is the CRM hosted?
25. Where is analytics data sent?
26. Can foreign parent-company employees access Turkish customer data?
27. Does international transfer require standard contracts or another Article 9 safeguard?
28. Have standard contracts been notified within five business days?
29. Does VERBIS registration or a Turkish representative obligation apply?
30. How will Consumer Arbitration Committee and Consumer Court disputes be handled?

Frequently Asked Questions

Can a foreign company sell products online to customers in Turkey?

Yes, subject to the consumer, e-commerce, customs, tax and data-protection rules applicable to the specific business model.

Do I need to establish a Turkish company?

Not necessarily for every cross-border sale, but a Turkish establishment may become commercially or legally necessary depending upon logistics, taxation, marketplace rules, licensing and business scale.

Does Turkish consumer law apply if my company is abroad?

Potentially. MÖHUK Article 26 preserves the mandatory minimum consumer protection of the consumer’s habitual residence law in the circumstances specified by that provision.

Can my terms say that only foreign law applies?

A governing-law clause does not necessarily deprive a protected consumer of mandatory habitual-residence protections under Article 26.

What is ETBIS?

ETBIS is Turkey’s Electronic Commerce Information System, used for registration and reporting by specified e-commerce operators.

Does every foreign website have to register with ETBIS?

The answer depends on the seller’s legal and operational structure. The Ministry’s registration rules identify particular service-provider and intermediary categories rather than simply treating accessibility from Turkey as the only test.

How long is the general withdrawal period?

Generally 14 days for qualifying distance contracts.

Does every online product have a 14-day return right?

No. Statutory exceptions exist, including qualifying immediately performed electronic services and immediately delivered intangible digital products.

How quickly must goods be delivered?

For ordinary distance sales of goods, the statutory period may not exceed 30 days under the applicable consumer framework.

What if the product is defective after the withdrawal period?

Defective-goods rights are distinct from withdrawal and may continue after the ordinary withdrawal period.

Can I automatically enrol every customer in marketing?

No. Commercial electronic messaging and KVKK requirements must be considered separately, and marketing consent should not be forced as a condition of obtaining the underlying product or service.

How quickly must marketing stop after an opt-out?

The Ministry states that electronic commercial messages must stop within three business days after the refusal request reaches the service provider.

Can analytics cookies run immediately?

Not necessarily. Where non-essential cookies depend on explicit consent, the KVKK Board requires an active opt-in approach rather than automatic activation.

Does using a foreign cloud server count as an international data transfer?

It can. The current KVKK regime treats transmission or making data accessible to a controller or processor abroad as an international transfer where the statutory criteria are met.

Did Turkish international data transfer law change?

Yes. The new Article 9 regime entered into force on 1 June 2024.

What are standard contracts?

They are Board-approved mechanisms for international data transfers. Four models exist for controller-controller, controller-processor, processor-processor and processor-controller transfers.

Do standard contracts need to be filed?

Yes. They must be notified to the Turkish Data Protection Authority within five business days after signatures are completed.

What is the Consumer Arbitration Committee threshold in 2026?

For 2026, qualifying disputes below TRY 186,000 fall within the Consumer Arbitration Committee monetary threshold.

Conclusion

Selling online to Turkish consumers requires more than translating an international website into Turkish and enabling local delivery.

Foreign e-commerce businesses need to consider at least four separate regulatory layers:

electronic commerce regulation,

consumer protection,

marketing communications,

and

personal data protection.

The first step is to define the business model.

A foreign company shipping directly to Turkey from abroad does not have the same legal structure as a Turkish subsidiary operating a domestic online store.

A seller using a Turkish marketplace does not have the same operational obligations as a company operating its own marketplace.

ETBIS obligations should therefore be analysed according to the actual role and establishment of the business.

The Ministry’s current guidance identifies service providers operating in their own e-commerce environments, intermediary service providers and certain Turkey-resident businesses selling through foreign intermediary platforms among the categories subject to ETBIS requirements.

The second major issue is consumer law.

The Distance Contracts framework imposes important pre-contract information requirements.

Online consumers generally benefit from a 14-day withdrawal right, subject to statutory exceptions.

Foreign companies should therefore build Turkish compliance into the actual checkout.

The legal documents should not appear only in an obscure footer.

They should correspond with:

• order flow;
• payment;
• delivery;
• return;
• withdrawal;
• refund;
• and complaint management.

The third issue is delivery.

International sellers sometimes underestimate the legal significance of shipping promises.

Turkish consumer law limits the performance period for ordinary goods in distance sales to a maximum of 30 days under the relevant statutory regime.

A seller shipping from Asia, the United States or another distant jurisdiction should therefore determine whether:

• inventory;
• customs clearance;
• and courier delivery

can actually satisfy its Turkish consumer obligations.

The fourth issue is defective products.

A customer whose 14-day withdrawal period has ended may still possess statutory rights if the goods are defective.

Refund, replacement and other consumer remedies must therefore be handled independently from ordinary “change of mind” returns.

The fifth issue is marketing.

Commercial electronic messaging is heavily regulated.

Turkish businesses and foreign businesses subject to the applicable framework need to address IYS consent management and customer refusals.

A refusal must be respected promptly; the Ministry currently states that the service provider must stop sending commercial electronic messages within three business days.

Marketing consent should also be kept separate from the underlying sale.

The Turkish Data Protection Board’s 2025 principle decision specifically rejected structures in which marketing consent is effectively forced on a customer as a mandatory condition for receiving the product or service.

The sixth issue is cookies and behavioural advertising.

The Turkish Data Protection Board’s e-commerce cookie decision makes clear that non-essential analytics, functional or advertising cookies cannot simply be activated by default where the relevant processing requires explicit consent. An active opt-in mechanism is required in those circumstances.

This is particularly important for international companies importing a global cookie banner into their Turkish site.

A banner designed only for another jurisdiction may not satisfy Turkish requirements.

The seventh—and increasingly most important—issue is international data transfer.

Modern e-commerce companies rarely keep all personal data inside one country.

A Turkish customer’s data may move through:

Turkish website → foreign CRM → global cloud provider → foreign parent company → international analytics platform.

Turkey’s rules changed significantly in 2024.

The new Article 9 regime entered into force on 1 June 2024 and introduced a structure based on adequacy, appropriate safeguards such as standard contracts or Binding Corporate Rules, and limited incidental exceptions.

For many international e-commerce businesses, the new standard contracts provide the most practical solution.

The Board has published four different models according to the controller/processor relationship.

But companies must remember the notification rule:

the completed standard contract must be notified to the Authority within five business days.

This means that international data transfer compliance should not be treated as a document that the privacy team signs once and forgets.

Every new:

• CRM;
• analytics provider;
• overseas processor;
• parent-company access arrangement;
• or cloud migration

can change the data-transfer map.

The eighth issue concerns foreign-law clauses.

MÖHUK Article 26 protects consumers against losing the minimum mandatory protection available under their habitual-residence law in qualifying consumer contracts merely because the business selected another governing law.

Therefore, foreign e-commerce companies targeting Turkish consumers should not rely upon:

“Our Terms say English law applies”

as a substitute for Turkish compliance.

Finally, companies should design a Turkish dispute-resolution strategy before the first customer complaint arrives.

In 2026, the Consumer Arbitration Committee monetary threshold is TRY 186,000. Larger qualifying disputes generally move through the mandatory mediation and Consumer Court framework under Article 73/A, subject to statutory exceptions.

For a high-volume online seller, one incorrectly drafted return or cancellation policy can therefore create hundreds or thousands of repeated claims.

The most effective approach to Turkish e-commerce compliance can be summarized as:

identify the selling entity → determine the sales channel → assess ETBIS obligations → localize consumer documents → build withdrawal and refund procedures → review marketplace responsibilities → structure IYS marketing consent → map all personal data → review cookies → establish an Article 9 international-transfer mechanism → create a Turkish dispute-handling procedure.

Turkey offers international businesses significant e-commerce opportunities.

But digital commerce does not remove borders from law.

A customer may complete an international purchase in thirty seconds.

The legal relationship created by that click can involve Turkish consumer law, Turkish data protection law, international private law, e-commerce regulation and cross-border data-transfer rules simultaneously.

For foreign companies, Turkish market entry should therefore be approached not simply as a translation project—

but as a legal localization project.

Legal Disclaimer

This article provides general legal information concerning e-commerce in Turkey for foreign companies, Turkish consumer law, distance sales, electronic commerce regulation and personal data protection as of August 2026.

It does not constitute legal, tax, customs, data protection or commercial advice concerning a specific business.

The applicable legal requirements can vary according to:

• where the seller is incorporated;
• whether it has a Turkish subsidiary;
• whether it maintains a Turkish establishment;
• whether it operates its own website;
• whether it uses a Turkish or international marketplace;
• products or services sold;
• consumer location;
• logistics structure;
• tax and customs model;
• commercial electronic message practices;
• personal data processed;
• cookies and advertising technology;
• cloud infrastructure;
• and countries to which customer information is transferred.

Foreign companies planning to target consumers in Türkiye should obtain business-model-specific legal advice before launching their Turkish website, marketplace operation or marketing campaign.